Privacy Policy

Last updated: September 13, 2026

1. Who we are

Qualibr is an AI-powered qualitative research analysis tool operated by an individual based in Spain. For any questions about this policy, contact us at: qualibr.dev@gmail.com

2. Our roles under GDPR

We act in two distinct roles depending on the data involved:

• Data Controller for your account information (email, name, password hash, session data): we determine the purposes and means of processing this data.
• Data Processor for research content you upload (interview transcripts, survey responses, articles, social media posts, or any other text-based materials): we process this content on your instructions, for the sole purpose of providing the analysis service. You, as the researcher, are the data controller for that content and are responsible for its lawful collection.

3. What data we collect

Account data When you register, we collect your email address and, optionally, your name. Your password is never stored — only a hash (PBKDF2, 100,000 iterations, SHA-512).

Research content you upload When you upload materials, we store the extracted text of those files. Original files are not retained — only the text. This content may include personal data about third parties (research respondents). See Section 7 for your responsibilities.

Project metadata Research questions, project descriptions, methodological notes, and target audience information that you enter.

Session data An HTTP-only cookie (qualibr_session) containing a signed token. It does not contain your password or research content.

Server logs Standard server logs may include your IP address and request timestamps. Research content is never logged.

4. Legal bases for processing (Article 6 GDPR)

We process your personal data on the following legal bases:

5. How we use your data

We use the data you provide to:

• Operate your account and store your projects
• Run AI analysis on your uploaded research materials (see Section 6)
• Apply rate limiting and maintain security of the service

We do not use your data for advertising. We do not sell your data. We do not use your research content — or any data obtained through your use of the service — to develop, improve, or train AI or machine learning models, whether personalized or general-purpose.

5a. Marketing emails

Sending you marketing emails (news and tips about Qualibr) requires your separate, opt-in consent — it is never a condition of using the service, and the checkbox is never pre-checked. You can withdraw this consent at any time, either through the toggle in Settings or the unsubscribe link included in every marketing email, without affecting your account or the transactional emails (verification, password reset) needed to operate it.

6. Third parties who process your data (sub-processors)

By using Qualibr, you agree that the following sub-processors process data on our behalf:

Anthropic (Claude API) When you run an analysis, the text of your uploaded research materials is sent to Anthropic's Claude API. Anthropic acts as a sub-processor. A Data Processing Agreement with Standard Contractual Clauses (Module 2 and Module 3 for EU data transfers) is automatically incorporated into Anthropic's commercial terms as of February 24, 2025. Anthropic's privacy policy: https://www.anthropic.com/privacy

Vercel Our application is hosted on Vercel. Vercel's privacy policy and DPA: https://vercel.com/legal/privacy-policy

We use Vercel Analytics to understand aggregate site traffic (e.g., page views, referring sources). It is designed to be privacy-friendly and does not use tracking cookies or collect personally identifiable information about individual visitors.

Turso Your account and project data are stored in a database provided by Turso (libSQL). Turso's privacy policy: https://turso.tech/privacy-policy

Resend Resend delivers every transactional email the application sends: the in-app feedback form (your message, name, email address, and any screenshot you attach), email verification, and password reset. If you opt in to marketing emails (see Section 5a), those are also sent via Resend. Resend does not process your research materials, codes, or other project content. Resend's privacy policy: https://resend.com/legal/privacy-policy

Google (Sign in with Google) When you choose to sign in or register using "Sign in with Google," Google acts as a sub-processor to verify your identity — we receive your email address, whether that email is verified, and your name from Google to create or access your Qualibr account. We never receive or store your Google password, and this sub-processor relationship is limited to sign-in only — we do not access any other Google account data or services. Google's privacy policy: https://policies.google.com/privacy

Lemon Squeezy Lemon Squeezy (legal entity: Sold through Link, LLC, a Utah limited liability company operating as Lemon Squeezy; part of Stripe) acts as our payment processor and merchant of record for paid plans. When you purchase a paid plan or credit top-up, Lemon Squeezy processes your email address, billing address or country, and payment details, and may collect a VAT ID if you provide one for tax purposes. Lemon Squeezy's privacy policy: https://www.lemonsqueezy.com/privacy (Payment processing is not yet connected — this sub-processor is listed ahead of launch, per Section 8 of the Terms of Service.)

Note on server locations: Turso database infrastructure and Vercel function infrastructure are both located in Dublin, Ireland (EU). Data transfers from the EU/EEA are covered by Standard Contractual Clauses (SCCs) in each provider's Data Processing Agreement, where applicable to any remaining cross-border processing (e.g., Anthropic).

7. Your responsibilities regarding research respondent data

You are the data controller for the content you upload. That content may contain personal data about third parties — research respondents, survey participants, authors of texts, or others. You are solely responsible for:

• Having a lawful basis under applicable law to upload and process this content using a third-party AI service
• Having obtained all necessary consents from respondents for AI-assisted processing of their personal data
• Complying with any ethical obligations from your institution, IRB, or research context

If your materials contain special categories of personal data under Article 9 GDPR — including health information, ethnic origin, political opinions, religious beliefs, immigration status, or data about vulnerable individuals — you bear additional responsibility to ensure this processing is lawful before uploading. We strongly recommend consulting your institution's data protection officer or ethics board.

If your data requires anonymisation under an ethics board protocol or other confidentiality requirements, please anonymise it before uploading — Qualibr does not perform automatic anonymisation at this time.

Qualibr does not identify, contact, or have any direct relationship with your respondents.

8. How long we keep your data

Your data is stored for as long as your account exists. Deleting a project or material permanently deletes its associated content immediately. Deleting your account permanently and immediately deletes all your data — projects, materials, codes, categories, and session records.

We do not apply automatic data retention limits. If you want your data deleted and cannot access your account, contact us at qualibr.dev@gmail.com.

Backups are your responsibility. You can export your data (codebook, reports, or a full data export of everything in your account) at any time while your account is active. Before deleting your account or a project, we recommend exporting anything you want to keep — once deletion is complete, we cannot recover it.

9. Your rights

You have the following rights regarding your personal data:

• Access: view your data through the application
• Correction: edit your account information and project content at any time
• Deletion: delete your projects, materials, and account through the application
• Portability: export your codebook, reports, or a full data export of everything in your account, instantly through the application (Settings)
• Restriction of processing: contact us at qualibr.dev@gmail.com
• Objection to processing: contact us at qualibr.dev@gmail.com
• Withdraw consent: close your account at any time, which stops all processing; for marketing emails specifically, toggle it off in Settings or use the unsubscribe link in any marketing email, without affecting your account

To exercise rights not available through the application, email us at qualibr.dev@gmail.com. We will respond within 30 days.

You have the right to lodge a complaint with the data protection authority in your country of residence.

10. Security

• Passwords: PBKDF2 hashes only, never in plain text
• Session cookies: HTTP-only, not accessible to JavaScript; transmitted over HTTPS only
• Access controls: each user can only access their own data
• Rate limiting: applied to authentication endpoints to prevent brute-force attacks
• Research content: stored as plain text in the database without separate application-level encryption (beyond the database provider's infrastructure protections)

Data breach notification: In the event of a personal data breach, we will notify the AEPD within 72 hours as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights, we will also notify you directly.

11. Children

Qualibr is not directed at individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, please contact us at qualibr.dev@gmail.com and we will delete it promptly.

12. Changes to this policy

We will notify you of material changes by email or in-app notice before changes take effect.